registry  /  @emngny/oh-my-kilocode-slim  /  2.1.2

@emngny/oh-my-kilocode-slim@2.1.2

Lightweight agent orchestration plugin for KiloCode - a slimmed-down fork of oh-my-kilocode-slim

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 5 file(s), 1.35 MB of source, external domains: 127.0.0.1, github.com, mcp.context7.com, mcp.exa.ai, mcp.grep.app, mcp.tavily.com, ohmykiloslim.com, registry.npmjs.org, unpkg.com, www.ibm.com, www.w3.org

Source & flagged code

5 flagged · loading source
dist/index.jsView file
49// src/utils/compat.ts L50: import { spawn as nodeSpawn } from "node:child_process"; L51: import { writeFile as fsWriteFile } from "node:fs/promises";
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L49
124} L125: function escapePowerShellPath(path4) { L126: return path4.replace(/'/g, "''");
High
Shell

Package source references shell execution.

dist/index.jsView on unpkg · L124
49// src/utils/compat.ts L50: import { spawn as nodeSpawn } from "node:child_process"; L51: import { writeFile as fsWriteFile } from "node:fs/promises"; ... L9124: _resolve: { value: function(href) { L9125: return new URL4(this._documentBaseURL).resolve(href); L9126: } }, ... L18822: try { L18823: const content = fs.readFileSync(configPath, "utf-8"); L18824: let rawConfig;
High
Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L49
49// src/utils/compat.ts L50: import { spawn as nodeSpawn } from "node:child_process"; L51: import { writeFile as fsWriteFile } from "node:fs/promises"; ... L58: if (!stream.readable) { L59: resolve(Buffer.concat(chunks).toString("utf-8")); L60: return; ... L70: options?.stdin ?? "ignore", L71: options?.stdout ?? "pipe", L72: options?.stderr ?? "pipe" ... L106: function getWindowsBuildNumber() { L107: if (process.platform !== "win32") L108: return null;
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L49
dist/cli/index.jsView file
21// src/utils/compat.ts L22: import { spawn as nodeSpawn } from "node:child_process"; L23: function collectStream(stream) { ... L29: if (!stream.readable) { L30: resolve(Buffer.concat(chunks).toString("utf-8")); L31: return; ... L41: options?.stdin ?? "ignore", L42: options?.stdout ?? "pipe", L43: options?.stderr ?? "pipe" ... L74: function getWindowsBuildNumber() { L75: if (process.platform !== "win32") L76: return null;
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L21

Findings

3 High4 Medium6 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighRemote Agent Bridgedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings